MCP.Market

Abnormal Security MCP server

by WYRE-AI·io.github.WYRE-AI/abnormal-mcp·v1.2.7
No reviews yet

MCP server for Abnormal Security — AI-powered email threat detection, cases, and remediation.

B70/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B70/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Abnormal Security yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Abnormal Security tools

No tool declarations could be read from the package source. They show once the server is installed.

Public scan report

scanner v0.1.10 · 2026-10-31 · same rubric, same numbers if you re-run it

no findings
  • –Code scanpackage could not be scannedn/a
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitystatic API keys via environment variables6/15
  • Maintenancelast push 11 days ago15/15
  • Maintainer identityregistry namespace matches repository owner7/10
Overall 70/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Abnormal Security compares

Against every graded Email MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
70/100
higher than 40% of 916 Email servers

Release history: 2 versions in the registry since 2026-08-26, latest 2026-10-14, typically one every 49 days.

Install Abnormal Security in Claude Code, Cursor or VS Code

claude mcp add abnormal-mcp -- docker run -i --rm ghcr.io/wyre-ai/abnormal-mcp:v1.2.7
Add to Cursor

What the publisher says

From the Abnormal Security repository's README, as published. We do not edit it. Read it on GitHub

abnormal-mcp

MCP server for Abnormal Security — AI-powered threat detection, case management, and email remediation.

Tools

This server uses a decision-tree architecture. Start by calling abnormal_navigate to select a domain, then use the domain-specific tools.

Navigation

Threats domain

Messages domain

Remediation domain

Abuse domain

Cases domain

Interactive Threat Card (MCP Apps)

hosts (Claude Desktop/web): subject, sender, attack classification, remediation status, and the messages in the threat. The card is read-only — remediation stays a deliberate, model-mediated action. Plain-JSON behavior is unchanged in other hosts. Neutral by default, brandable via window.BRAND injection or MCPBRAND env vars (MCPBRANDNAME, MCPBRANDLOGOURL, MCPBRANDPRIMARYCOLOR, MCPBRANDACCENTCOLOR, MCPBRANDBG, MCPBRAND_TEXT) — no rebuild needed.

  • abnormalthreatsget renders as an interactive threat card in MCP Apps

Authentication

Abnormal Security uses Bearer token authentication.

Standalone (env mode)

export ABNORMAL_API_TOKEN=your-api-token
node dist/index.js

Generate your token in the Abnormal portal under Settings > Integrations > API.

Gateway mode

When deployed behind the MCP gateway, set AUTH_MODE=gateway. The gateway injects the Authorization: Bearer {token} header automatically on each request.

Running

stdio (for Claude Desktop)

npm install
npm run build
node dist/index.js

HTTP Streamable (for hosted/gateway deployment)

MCP_TRANSPORT=http AUTH_MODE=gateway node dist/index.js

Docker

docker compose up

Development

npm install
npm run dev          # watch mode
npm test             # run tests
npm run typecheck    # TypeScript type check
npm run build:ui     # rebuild the MCP Apps card bundle (only needed when ui/ changes)

License

Apache-2.0

Nothing above is checked by us. What we check is on the safety report.

Abnormal Security: common questions

Is Abnormal Security MCP server safe?
Mostly: it is graded B (70/100). Read the Abnormal Security safety report
How do I install Abnormal Security?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Abnormal Security need an API key?
Yes. The registry entry asks for ABNORMAL_API_TOKEN.
Is Abnormal Security maintained?
The last commit was 16 days ago (2026-10-19). The latest release is v1.2.7.
What can I use instead of Abnormal Security?
Servers from other publishers that do the same job: Netintel MCP server, BlackVeil DNS & Email Security Scanner MCP server and IntoDNS.ai DNS & Email Security Scanner MCP server.

Alternatives to Abnormal Security

Same job from other publishers: the closest match first, then the best rated.

  • Netintel
    MCP server for NetIntel — DNS, SSL, WHOIS, email security, OSINT via x402 micropayments
    B
  • BlackVeil DNS & Email Security Scanner
    DNS and email security scanner with 81 MCP tools for SPF, DMARC, DNSSEC, SSL, and brand audits.
    B
  • IntoDNS.ai DNS & Email Security Scanner
    DNS and email security: check SPF, DKIM, DMARC, DNSSEC, DANE and build the records. 45 tools.
    B
  • Mailoo - Email MCP Server
    Email MCP server for AI agents: IMAP/SMTP, Gmail, Outlook, calendar, ManageSieve, AI triage, OAuth2.
    A
  • emailmd
    Render markdown into email-safe HTML, lint drafts for deliverability problems, and preview emails.
    A

More from WYRE-AI →